PT-2026-72980

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci past sync callback Avoids giving freed pointers to hci conn valid, which kmalloc may have reused. Hold refcount to avoid that...

PT-2026-72945

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket use-after-free during link group termination smc lgr terminate drops conns lock after finding a connection in lgr-conns all, but before taking a reference on its socket. The connection is embedded in the socke...

PT-2026-72981

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: hold conn in hci connect pa sync callback There is theoretical UAF if the conn is freed while the hci sync task is running. Hold refcount to avoid that...

PT-2026-72963

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix pending command UAF in EIR updates MGMT OP SET LOCAL NAME is handled asynchronously on powered controllers and can run set name sync. When the controller is BR/EDR capable, set name sync updates the local nam...

PT-2026-72335

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma-pcie: Reject devices without driver data dw edma pcie probe treats the PCI device ID driver data as the template for the controller layout and copies it unconditionally. A device bound dynamically via sysfs can...

PT-2026-72319

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTH RECEIVE buffers nvmet execute auth receive trusts the AUTH RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default state...

PT-2026-72354

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix infinite loop in p9 client rpc on fatal signal When p9 client rpc is called with type P9 TFLUSH and the transport has no peer e.g. fd transport backed by pipes with no 9p server, a fatal signal causes an infinite loop...

PT-2026-72299

In the Linux kernel, the following vulnerability has been resolved: bpf,fork: wipe -bpf storage before bailouts that access it Currently, copy process can bail out to free task before p-bpf storage has been initialized, with this call graph shown here for the !CONFIG MEMCG case: copy process dup...

PT-2026-72274

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsiback get pend req obtains a command tag and returns a vscsibk pend whose embedded se cmd has only been memset to 0, so its cmd kref is 0; the se cmd i...

PT-2026-72307

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race within the bcm rx handler when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. Use atomic operations with...

PT-2026-72294

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitset size overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to region count overflow" made sure that region count could fit in an unsigned int. But the bitmap memory isn't allocat...

PT-2026-72302

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6...

PT-2026-72217

In the Linux kernel, the following vulnerability has been resolved: riscv: probes: save original sp in rethook trampoline Reading a word from the stack in a kretprobe crashes a risc-v kernel. $ cd /sys/kernel/tracing/ $ echo 'r n tty write $stack0' dynamic events $ echo 1 events/kprobes/enable...

PT-2026-72225

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch multiq: Replace direct dequeue call with peek and qdisc dequeue peeked multiq dequeue takes a packet from a band's child with a direct -dequeue call after multiq peek peeked it. When the child is non-work-conservin...

PT-2026-72230

In the Linux kernel, the following vulnerability has been resolved: espintcp: use sk msg free partial to fix partial send sk msg free partial ensures consistency of the skmsg at every iteration, without having to manually handle uncharges and offsets. This simplifies the code, and fixes some bugs...

PT-2026-72402

In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-battery: Fix missing nvmem device put causing reference leak In cpcap battery detect battery type, the reference to an nvmem device obtained via nvmem device find is not released with nvmem device put on the...

PT-2026-72643

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to audit log untrustedstring Commit 4a134723f9f1 "apparmor: move check for aa null file to cover all cases" intrdouced a small bug, where path name may pass a potentially uninitialized...

PT-2026-72640

In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intel crtc put color blobs drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intel crtc prepare cleared state,...

PT-2026-72615

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix effective prog array index with BPF F PREORDER replace effective prog and purge effective progs located the slot in the effective array by walking the program hlist and counting entries linearly. That count does not matc...

PT-2026-72610

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn-preauth info in concurrent SMB2 NEGOTIATE conn-preauth info is shared connection state struct preauth integrity info, kmalloc-96 that is allocated and freed by the SMB2 NEGOTIATE handler and read...